Subprocessors
A subprocessor is a company we hire that ends up handling some of your data to do its job. Here is the whole list, split into the ones every account uses, the AI vendors, and the ones that only apply if you switch on a particular integration. We don't sell your data to anyone on this page, or to anyone else.
Core infrastructure
These are in the path for every account. Using Projlog means using these.
| Provider | What they do | What they receive | Where |
|---|---|---|---|
| Supabase | Database, file storage, and authentication | All Service data: accounts, project data, messages, photos, documents, sign-in credentials | United States |
| Vercel | Application hosting and delivery | All requests to the Service, including IP address and request metadata | United States |
| Stripe | Payment processing and subscription billing | Payment card details, billing name and address, payment status. Card numbers go to Stripe directly and are never stored by us | United States |
| Resend | Transactional email delivery | Email addresses, message subject and content, delivery events | United States |
| Twilio | Text message and voice call delivery | Phone numbers, message content, call metadata, and call recordings where a Company enables them | United States |
| Sentry | Error and performance monitoring | Error reports, request metadata, and — on a sample of sessions where an error occurs — a replay of the page with text masked and images and video omitted | United States |
| Upstash | Rate limiting | IP addresses and account identifiers, held briefly to count requests | United States |
| Cloudflare | Public asset delivery for map views | IP address and browser data when a map loads its icons and stylesheet | Global |
| Plausible Analytics | Website analytics on our public marketing pages only | Aggregate page views. No cookies, no cross-site tracking, and it does not run inside the Service | European Union |
| Backblaze | Off-site backup storage for uploaded files | Encrypted copies of photos and documents, written nightly. Files are encrypted on our side before they leave, so Backblaze cannot read them | United States |
| GitHub | Runs the nightly backup job that makes those copies | Photos and documents pass through the backup job's runner briefly during each nightly run; nothing is stored there | United States |
AI providers
These receive content only when someone uses a feature that is labeled as AI-assisted, or when a Company runs the prospecting tools. Section 07 of the privacy policy explains which features those are and exactly what gets sent.
| Provider | What they do | What they receive | Where |
|---|---|---|---|
| Anthropic | Drafting assistance (crew updates, end-of-day summaries), the staff assistant, and roof-condition assessment in the prospecting tools | The text or image sent with a request. Not used to train their models | United States |
| OpenAI | Fallback for the same drafting and assistant features, and speech-to-text for voice notes and dictation | The text sent with a request, and audio recordings when someone uses a voice feature. Not used to train their models | United States |
Optional integrations
None of these receive anything until a Company connects the integration in Settings. Disconnecting it stops the flow going forward.
| Provider | What they do | What they receive | Where |
|---|---|---|---|
| Sign in with Google, Calendar sync, Maps and Places lookups, Street View imagery, and Business Profile reviews | Name, email, and profile ID at sign-in; calendar events; property addresses sent for lookup or imagery | United States | |
| Microsoft | Sign in with Microsoft | Name, email address, and profile identifier | United States |
| Intuit (QuickBooks) | Accounting sync | Customer names, invoices, payments, and line items | United States |
| Zoom | Video consultations | Meeting scheduling details and participant email addresses | United States |
| Mailchimp | Marketing email, for Companies that connect their own account | Contact names and email addresses the Company chooses to sync | United States |
| EagleView, GAF QuickMeasure, Roofr | Aerial roof measurement reports | Property addresses and the resulting measurement reports | United States |
| ABC Supply, SRS Distribution, Beacon | Material catalog and ordering | Order contents and job-site delivery addresses | United States |
| Tomorrow.io | Weather forecasts for scheduling and daily reports | Job-site coordinates or postal codes | United States |
| Apollo.io, Hunter.io | Business contact lookup in the prospecting tools | Company names and business contact details submitted for lookup. See the note below | United States |
| Regrid | Property parcel and ownership records in the prospecting tools | Property addresses and parcel identifiers. See the note below | United States |
A note about the prospecting tools
The prospecting tools differ from the rest of Projlog in one important way: they process information about property owners who are not our users and have no relationship with us. A Company using those tools chooses whose property to look up, and is the controller of that information and responsible for having a lawful basis to process it. We are the processor. Section 07 of the privacy policy describes what the tools do, and any property owner can write to privacy@projlog.app to ask what we hold about a property and to have it deleted.
When this list changes
We update this page when we add or remove a subprocessor, and Companies can ask to be notified of changes in advance by writing to privacy@projlog.app. If you have a data processing agreement with us, the notice terms in that agreement control.